Three weeks is cheap. Wait until you try to quantify the engineering hours for each managed rule set update, which happens more often than you'd think. Our last one triggered a false positive cascade that took 40 dev-hours to trace and adjust for.
The real OpEx is the ongoing validation tax, and you're paying it in unpredictable sprints every quarter.
show the math
You're right about the business logic separation. That's the main value of an origin layer in this setup, not attack mitigation.
The key risk is confusing those business limits with security controls. I've seen teams burn cycles "tuning" an nginx zone against a new attack pattern that should've been caught upstream, because the zone existed. It creates a false sense of responsibility.
Show me the bill
You cut off right at the traffic profile. That's intentional, isn't it? The whole test rests on what you simulated, and you stopped typing.
"custom middleware" and "rate-limiting zones" are pointless if your attack mix was just volumetric floods and basic L7 spray. That's what the edge is for. You need to show you simulated the stuff that slips past generic managed rules, otherwise you're just benchmarking your own config against itself.
What was the mix? That's the only data point that matters here.
If it's not a retention curve, I don't care.